MC/DC coverage for verification functions via witness (WASM harness)

[avrabe]

Goal

Re-evaluate the coverage of sigil's verification functions with MC/DC (Modified Condition/Decision Coverage) using pulseengine/witness, instead of the line-coverage heuristic used in #127.

This is the rigorous follow-up to #127. MC/DC is the coverage criterion DO-178C Level A / DO-333 actually require — it proves each condition in a compound boolean independently flips the outcome, which line coverage (and CRAP) cannot. witness measures it post-rustc/LLVM lowering on the shipped Wasm, and emits an in-toto coverage predicate that sigil itself can consume — the witness↔sigil integration is designed in.

witness v0.22.0 was verified working locally (leap-year fixture → 1/1 decisions full MC/DC).

Why this isn't a one-shot

witness instruments a Wasm module and invokes its exports with typed args, reconstructing MC/DC from branch counters. sigil's wsc-component.wasm exports only the WASI CLI run entry — not granular verification functions — so it can't be measured directly.

It needs a dedicated witness harness crate:

• A new wasm32-wasip2 crate (the wsc lib already builds for wasip2) that exports scenario-driven wrappers, e.g. run_verify_multi_scenario(scenario: i32) -> i32.
• Each scenario constructs a fixture and calls the real verification function, with inputs crafted to flip one MC/DC condition at a time — this is the MC/DC test-design work, and it is the actual value.
• witness instrument + witness run --invoke → per-decision truth tables → witness predicate → signed in-toto coverage predicate.

Scope

Target the #127 punch-list verifiers, highest-risk first:

• PublicKey::verify_multi
• verify_attestation_signature
• AirGappedVerifier::verify_signature
• KeylessVerifier::verify
• RekorKeyring::verify_inclusion_proof

Outcome

MC/DC truth tables for the verification decision logic — certification-grade evidence, feedable into rivet as requirement-to-test traceability and into sigil's own attestation chain as a coverage predicate. This supersedes the line-coverage view of #127 for these functions.

Related: #127 (cargo-crap line-coverage punch list).

[avrabe]

PoC blocker found: wsc does not build for wasm via plain cargo

While scaffolding the verify_multi proof-of-concept, the harness approach hit a hard, verified wall:

$ cargo build -p wsc --lib --target wasm32-wasip2
error: failed to run custom build command for `ring v0.17.14`
  unable to create target: 'No available targets are compatible with triple "wasm32-unknown-wasip2"'

ring (pulled in unconditionally by rustls, declared in wsc's Cargo.toml for the keyless cert-pinning transport) cannot target the wasm triple with the default toolchain. sigil's real wsc-component.wasm only builds through the Bazel rules_wasm_component pipeline, which supplies a toolchain that handles this — plain cargo build --target wasm32-* does not.

Consequence: a witness harness cannot just be a cargo crate depending on wsc. The original plan in this issue ("a wasm32-wasip2 crate that depends on wsc") is not viable as written.

Two real paths (this changes the issue's scope)

1. Bazel rust_wasm_component harness. Build the harness the same way wsc-component.wasm is built — a rules_wasm_component target. Goes through the toolchain that already works. Cost: Bazel integration, and witness must instrument a component (wasip2) rather than a core module.

2. Carve a network-free verification subcrate. verify_multi is the classic Ed25519 path — its actual transitive code touches only Module/sig_sections/ed25519-compact/sha2, not ring/rustls/ureq. Extracting the network-free verification core into its own crate would let it build cleanly for wasm32-unknown-unknown and be witness-instrumented directly with plain cargo — the simplest path witness documents. This is also sound architecture (separating the verification core from the Sigstore/keyless machinery).

Path 2 is the cleaner long-term answer and makes witness adoption easy; path 1 is faster but ties MC/DC measurement to the Bazel pipeline. Either is a real, focused task — not a quick scaffold.